They should at least make their sign-up and login password fields have the same max length attributes...
It's even worse than that the BMC is a preconfigured part of the server not something you go to a sign up page for. It's literally the _change password functionality_ that does not warn/error on the password being too long!
Re:I hate password rules
by throwawayboise on Tuesday November 16, 2021 @06:28PM
(#29247582)
I had seen the same thing on a (much older) switch, which is the only reason I thought to try truncating my password. Worked after dropping only one character, I was sort of expecting it to be 16 or maybe even 8.
> However if I log in with just the first 20 characters of the password, it works.
Even worse is when the password change form accepts more characters and processes them correctly, only to have the login form not allow you to enter all characters. If I'm not mistaken, the business remote deposit portal my bank uses does this.
Could that mean that the password is stored unhashed?
Re:I hate password rules
by johnisgood on Thursday November 18, 2021 @04:59AM
(#29263842)
Since the number of characters is the same in the case of hashes, yes, the password is saved as-is.
Apparently there is a limit of 20 characters for the password. The password I set was 21 characters (which was accepted without error).
When I tried to log in with this password, the login was rejected.
However if I log in with just the first 20 characters of the password, it works.